# Vulnerabilities published in 2021


- [CVE-2021-24479](https://insights.sbomify.com/CVE-2021-24479/): DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24478](https://insights.sbomify.com/CVE-2021-24478/): Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24477](https://insights.sbomify.com/CVE-2021-24477/): Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24476](https://insights.sbomify.com/CVE-2021-24476/): Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24474](https://insights.sbomify.com/CVE-2021-24474/): Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS) (medium 6.1)
- [CVE-2021-24473](https://insights.sbomify.com/CVE-2021-24473/): User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR (medium 5.4)
- [CVE-2021-24472](https://insights.sbomify.com/CVE-2021-24472/): Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF (critical 9.8)
- [CVE-2021-24471](https://insights.sbomify.com/CVE-2021-24471/): YouTube Embed < 5.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24470](https://insights.sbomify.com/CVE-2021-24470/): Yada Wiki < 3.4.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-2447](https://insights.sbomify.com/CVE-2021-2447/): Other in Secure Global Desktop (critical 9.9)
- [CVE-2021-24468](https://insights.sbomify.com/CVE-2021-24468/): Leaflet Map < 3.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24467](https://insights.sbomify.com/CVE-2021-24467/): Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS (medium 6.5)
- [CVE-2021-24466](https://insights.sbomify.com/CVE-2021-24466/): Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS (medium 6.1)
- [CVE-2021-24465](https://insights.sbomify.com/CVE-2021-24465/): Meow Gallery < 4.1.9 - Contributor+ SQL Injection (high 8.1)
- [CVE-2021-24464](https://insights.sbomify.com/CVE-2021-24464/): YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24463](https://insights.sbomify.com/CVE-2021-24463/): Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection (high 8.8)
- [CVE-2021-24462](https://insights.sbomify.com/CVE-2021-24462/): Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-24461](https://insights.sbomify.com/CVE-2021-24461/): FAQ Builder < 1.3.6 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-24460](https://insights.sbomify.com/CVE-2021-24460/): Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-2446](https://insights.sbomify.com/CVE-2021-2446/): Other in Secure Global Desktop (critical 9.6)
- [CVE-2021-24459](https://insights.sbomify.com/CVE-2021-24459/): Survey Maker < 1.5.6 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-24458](https://insights.sbomify.com/CVE-2021-24458/): Popup box < 2.3.4 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-24457](https://insights.sbomify.com/CVE-2021-24457/): Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL Injections (high 8.8)
- [CVE-2021-24456](https://insights.sbomify.com/CVE-2021-24456/): Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections (high 7.2)
- [CVE-2021-24455](https://insights.sbomify.com/CVE-2021-24455/): Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24454](https://insights.sbomify.com/CVE-2021-24454/): YOP Poll < 6.2.8 - Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24453](https://insights.sbomify.com/CVE-2021-24453/): Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning (high 8.8)
- [CVE-2021-24452](https://insights.sbomify.com/CVE-2021-24452/): W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context) (medium 6.1)
- [CVE-2021-24451](https://insights.sbomify.com/CVE-2021-24451/): Export Users With Meta < 0.6.5 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24450](https://insights.sbomify.com/CVE-2021-24450/): ProfilePress < 3.1.8 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-2445](https://insights.sbomify.com/CVE-2021-2445/): Other in Hyperion Infrastructure Technology (medium 5.7)
- [CVE-2021-24448](https://insights.sbomify.com/CVE-2021-24448/): Profile Builder < 3.4.8 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24447](https://insights.sbomify.com/CVE-2021-24447/): WP Image Zoom < 1.47 - Local File Inclusion (medium 5.3)
- [CVE-2021-24446](https://insights.sbomify.com/CVE-2021-24446/): Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24445](https://insights.sbomify.com/CVE-2021-24445/): My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.5)
- [CVE-2021-24444](https://insights.sbomify.com/CVE-2021-24444/): TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24443](https://insights.sbomify.com/CVE-2021-24443/): Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography (medium 5.4)
- [CVE-2021-24442](https://insights.sbomify.com/CVE-2021-24442/): Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2021-24441](https://insights.sbomify.com/CVE-2021-24441/): Sign-up Sheets < 1.0.14 - Authenticated CSV Injection (high 8.0)
- [CVE-2021-24440](https://insights.sbomify.com/CVE-2021-24440/): Sign-up Sheets < 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-2444](https://insights.sbomify.com/CVE-2021-2444/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24439](https://insights.sbomify.com/CVE-2021-24439/): Browser Screenshots < 1.7.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24438](https://insights.sbomify.com/CVE-2021-24438/): ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24437](https://insights.sbomify.com/CVE-2021-24437/): Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24436](https://insights.sbomify.com/CVE-2021-24436/): W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context) (medium 6.1)
- [CVE-2021-24435](https://insights.sbomify.com/CVE-2021-24435/): Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24434](https://insights.sbomify.com/CVE-2021-24434/): Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24433](https://insights.sbomify.com/CVE-2021-24433/): Simple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSS (medium 5.4)
- [CVE-2021-24432](https://insights.sbomify.com/CVE-2021-24432/): Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24431](https://insights.sbomify.com/CVE-2021-24431/): Language Bar Flags <= 1.0.8 - CSRF to Stored XSS (medium 4.3)
- [CVE-2021-24430](https://insights.sbomify.com/CVE-2021-24430/): Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE (high 7.2)
- [CVE-2021-2443](https://insights.sbomify.com/CVE-2021-2443/): Other in VM VirtualBox (high 7.3)
- [CVE-2021-24429](https://insights.sbomify.com/CVE-2021-24429/): Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24428](https://insights.sbomify.com/CVE-2021-24428/): RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24427](https://insights.sbomify.com/CVE-2021-24427/): W3 Total Cache < 2.1.3 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24426](https://insights.sbomify.com/CVE-2021-24426/): Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24425](https://insights.sbomify.com/CVE-2021-24425/): myStickymenu < 2.5.2 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24424](https://insights.sbomify.com/CVE-2021-24424/): WP Reset < 1.90 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24423](https://insights.sbomify.com/CVE-2021-24423/): UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24421](https://insights.sbomify.com/CVE-2021-24421/): WP JobSearch < 1.7.4 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24420](https://insights.sbomify.com/CVE-2021-24420/): Request a Quote < 2.3.4 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-2442](https://insights.sbomify.com/CVE-2021-2442/): Denial of service in VM VirtualBox (medium 6.0)
- [CVE-2021-24419](https://insights.sbomify.com/CVE-2021-24419/): WP YouTube Lyte < 1.7.16 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24418](https://insights.sbomify.com/CVE-2021-24418/): Smooth Scroll Page Up/Down Buttons <= 1.4 - Authenticated Stored XSS via psb_positioning (medium 4.8)
- [CVE-2021-24416](https://insights.sbomify.com/CVE-2021-24416/): StreamCast < 2.1.1 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24415](https://insights.sbomify.com/CVE-2021-24415/): Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24414](https://insights.sbomify.com/CVE-2021-24414/): YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24413](https://insights.sbomify.com/CVE-2021-24413/): Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24412](https://insights.sbomify.com/CVE-2021-24412/): Html5 Audio Player < 2.1.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24411](https://insights.sbomify.com/CVE-2021-24411/): Social Tape <= 1.0 - CSRF to Stored XSS (medium 6.1)
- [CVE-2021-24410](https://insights.sbomify.com/CVE-2021-24410/): Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS (medium 6.1)
- [CVE-2021-2441](https://insights.sbomify.com/CVE-2021-2441/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24409](https://insights.sbomify.com/CVE-2021-24409/): Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24408](https://insights.sbomify.com/CVE-2021-24408/): Prismatic < 2.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24407](https://insights.sbomify.com/CVE-2021-24407/): Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24406](https://insights.sbomify.com/CVE-2021-24406/): wpForo Forum < 1.9.7 - Open Redirect (medium 6.1)
- [CVE-2021-24405](https://insights.sbomify.com/CVE-2021-24405/): Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting (medium 6.5)
- [CVE-2021-24404](https://insights.sbomify.com/CVE-2021-24404/): WP-Board <= 1.1 (beta) - Unauthenticated SQL Injection (high 8.8)
- [CVE-2021-24403](https://insights.sbomify.com/CVE-2021-24403/): WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection (high 7.2)
- [CVE-2021-24402](https://insights.sbomify.com/CVE-2021-24402/): WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection (high 7.2)
- [CVE-2021-24401](https://insights.sbomify.com/CVE-2021-24401/): WP Domain Redirect <= 1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24400](https://insights.sbomify.com/CVE-2021-24400/): Display users <= 2.0.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-2440](https://insights.sbomify.com/CVE-2021-2440/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24399](https://insights.sbomify.com/CVE-2021-24399/): The Sorter <= 1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24398](https://insights.sbomify.com/CVE-2021-24398/): Responsive 3D Slider <= 1.2 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24397](https://insights.sbomify.com/CVE-2021-24397/): MicroCopy <= 1.1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24396](https://insights.sbomify.com/CVE-2021-24396/): GSEOR <= 1.3 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24395](https://insights.sbomify.com/CVE-2021-24395/): Embed Youtube Video <= 1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24394](https://insights.sbomify.com/CVE-2021-24394/): Easy Testimonial Manager <= 1.2.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24393](https://insights.sbomify.com/CVE-2021-24393/): Comment Highlighter <= 0.13 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24392](https://insights.sbomify.com/CVE-2021-24392/): WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24391](https://insights.sbomify.com/CVE-2021-24391/): Cashtomer <= 1.0.0 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24390](https://insights.sbomify.com/CVE-2021-24390/): Alipay <= 3.7.2 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-2439](https://insights.sbomify.com/CVE-2021-2439/): Other in Hyperion BI+ (medium 4.3)
- [CVE-2021-24389](https://insights.sbomify.com/CVE-2021-24389/): FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24388](https://insights.sbomify.com/CVE-2021-24388/): Vik Rent Car < 1.1.7 - CSRF to Stored XSS (medium 5.4)
- [CVE-2021-24387](https://insights.sbomify.com/CVE-2021-24387/): Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24386](https://insights.sbomify.com/CVE-2021-24386/): WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVG (medium 5.4)
- [CVE-2021-24385](https://insights.sbomify.com/CVE-2021-24385/): Filebird 4.7.3 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24384](https://insights.sbomify.com/CVE-2021-24384/): JoomSport < 5.1.8 - Unauthenticated PHP Object Injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/213/